TFTP Firmware to a Bricked DVR Help

IT Guy

n3wb
Joined
Jun 21, 2022
Messages
7
Reaction score
0
Location
Wisconsin
I have several Honeywell HRHH DVRs that are currently unbootable that I would like to try to flash but I don’t know the complete method. I’m pretty sure they all have corrupted firmware. They have serial ports that show the booting process. I have the firmware file I need to flash to it. When booting it eventully shows “LZMA data is corrupt”.

The serial port data shows the TFTP after a few seconds:
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x3000000

Do I need to somehow create the 'upgrade_info_7db780a713a4.txt' file?

When I open the Firmware with WinRAR the .bin file contains (gave an extraction error):
custom-x.cramfs.img 4,160
logo-x.cramfs.img 4,160
romfs-x.cramfs.img 13,074,496
sign.img 128
u-boot.bin.img 309,500
web-x.cramfs.img 1,552,448

There's another thread talking about unbricking cameras which seems to use the same TFTP method:
I haven't been able to figure it out yet.

Any help would be appreciated. I don’t use Linux much. I do have access to working DVRs of the same type if I need to look at anything on them.

Thanks in advance,
IT Guy
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,961
Reaction score
5,874
Location
Scotland
When I open the Firmware with WinRAR the .bin file contains (gave an extraction error):
custom-x.cramfs.img 4,160
logo-x.cramfs.img 4,160
romfs-x.cramfs.img 13,074,496
sign.img 128
u-boot.bin.img 309,500
web-x.cramfs.img 1,552,448
Suggestion :
Convert the firmware.bin file into a valid .zip archive by changing the first 2 bytes from DH into PK.
Use unzip or WinRAR to extract the components parts. This should not give an error now.

Load the 'Install' file into a text editor, and inspect it to show the files to install and the order to do them in.

On the NVR serial console, interrupt the bootup to get to the bootloader prompt (probably '> ') and use
printenv
to see what macros are defined.
These will relate to the component filenames you extracted from the firmware.

Use
help
to list the available commands.

Going through the list of files from 'Install' in sequence, locate the corresponding macro definition as seen from the 'printenv' command and execute it with the 'run' command, for example for the romfs file
run dr
In the first instance, skip executing any that includes the boot file or files.

When all done, use the command
reset
to boot the device and observe if the applied firmware was accepted.
I hope that makes sense.
 

IT Guy

n3wb
Joined
Jun 21, 2022
Messages
7
Reaction score
0
Location
Wisconsin
I changed the start of the firmware file to PK and was able to unzip it all.

I looked at the "Install.lua" file in wordpad and I found a couple of things that you said to look for:
0xa0000000 £ 0xa0040000 256K armboot u-boot
0xa0060000 £ 0xa0CE0000 12800K kernel + root romfs
0xa0CE0000 £ 0xa0E60000 1536K web web
0xa0e60000 £ 0xa0e80000 128K custom custom
0xa0e80000 £ 0xa0ec0000 256K logo logo
0xa0ec0000 £ 0xa0f40000 1024K config
0xa0f40000 £ 0xa1000000 1024K config1

Also found this:

local flashPartions =
{
boot = { baseAddr = 0xa0000000 , endAddr = 0xa0050000 },
rootfs = { baseAddr = 0xa0060000 , endAddr = 0xa0CE0000 },
web = { baseAddr = 0xa0CE0000 , endAddr = 0xa0E60000 },
custom = { baseAddr = 0xa0E60000 , endAddr = 0xa0E80000 },
logo = { baseAddr = 0xa0E80000 , endAddr = 0xa0EC0000 },
config = { baseAddr = 0xa0EC0000 , endAddr = 0xa0f40000 },
config1 = { baseAddr = 0xa0f40000 , endAddr = 0xa1000000 },
}

This was near the end of the file:

if ( 1 ~= (self:crc32check( "u-boot.bin.img"))
or 1 ~= (self:crc32check("romfs-x.cramfs.img"))
or 1 ~= (self:crc32check("user-x.cramfs.img"))
or 1 ~= (self:crc32check("web-x.cramfs.img"))
or 1 ~= (self:crc32check("slave-x.cramfs.img"))
or 1 ~= (self:crc32check("logo-x.cramfs.img"))
or 1 ~= (self:crc32check( "custom-x.cramfs.img")) ) then
print("==>Upgrade: crc32check error!");
return false;
end

self:updatePart(flashPartions["boot"], "u-boot.bin.img");
--mtd.saveenv();
self:updatePart(flashPartions["rootfs"], "romfs-x.cramfs.img");
--self:updatePart(flashPartions["user"], "user-x.cramfs.img");
self:updatePart(flashPartions["web"], "web-x.cramfs.img");
--self:updatePart(flashPartions["slave"], "slave-x.cramfs.img");
self:updatePart(flashPartions["custom"], "custom-x.cramfs.img");
self:updatePart(flashPartions["logo"], "logo-x.cramfs.img");
--self:InstallPlayer("autoplayer.bin");
self:postInstall();
print("==>Upgrade finished.");
return true;
end

Still not sure what to do or how to get the firmware in.

Thanks,
IT Guy
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,961
Reaction score
5,874
Location
Scotland
Still not sure what to do or how to get the firmware in.
Check the bootloader environment variables using
printenv
to see what definitions there are for the tftp commands to use to apply the individual firmware components as per the update steps you've listed above.

Maybe similar example :
Code:
U-Boot 2010.06-svn1660 (Feb 03 2015 - 13:20:41)

TI8168-GP rev 2.0

ARM clk: 1200MHz
DDR clk: 796MHz
DSP clk: 813MHz
IVA clk: 531MHz
M3  clk: 250MHz

DRAM:  1 GiB
SPI:   info: found S25FL256S (32MiB)
Net:   Detected MACID:90:2:a9:95:5:72
Ethernet PHY: GENERIC[0x70431] @ 0x00
DaVinci EMAC
Hit any key to stop autoboot:  0
TI8168_EVM# *********
Unknown command '*********' - try 'help'
TI8168_EVM#
TI8168_EVM#
TI8168_EVM# printenv
bootcmd=fsload;bootm
bootdelay=3
load_modules=1
logserver=127.0.0.1
da=tftp 0x81000000 u-boot.bin.img; flwrite
dr=tftp 0x81000000 romfs-x.cramfs.img; flwrite
du=tftp 0x81000000 user-x.cramfs.img; flwrite
dw=tftp 0x81000000 web-x.cramfs.img; flwrite
dl=tftp 0x81000000 logo-x.cramfs.img; flwrite
ds=tftp 0x81000000 slave-x.cramfs.img; flwrite
dc=tftp 0x81000000 custom-x.cramfs.img; flwrite
up=tftp 0x81000000 update.img; flwrite
tk=tftp 0x81000000 uImage; bootm
baudrate=115200
autoload=no
verify=yes
bootfile=/boot/uImage
cramfsaddr=0x8460000
loadaddr=0x81000000
ethaddr=90:02:a9:95:05:72
eth1addr=20:32:04:01:50:38
ID=YGA3AQ01900025
netmask=255.255.0.0
gatewayip=255.255.255.255
restore=0
ethact=DaVinci EMAC
dh_keyboard=0
ipaddr=192.168.1.50
serverip=192.168.1.99
bootargs=mem=270M console=ttyO0,115200n8 rootfstype=cramfs root=/dev/mtdblock1 notifyk.vpssm3_sva=0xBFD00000 pcie=gen1
appauto=1
watchdog=1
HWID=00000000000000
stdin=serial
stdout=serial
stderr=serial

Environment size: 968/131068 bytes
TI8168_EVM#
The use the commands to install the firmware files, skipping the one(s) for the bootloader.

Maybe similar example:

Code:
TI8168_EVM# run dw
Using DaVinci EMAC device
TFTP from server 192.168.1.99; our IP address is 192.168.1.50
Filename 'web-x.cramfs.img'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################################
done
Bytes transferred = 1519680 (173040 hex)
SPI:   info: found S25FL256S (32MiB)
SPI probe: 32768 KiB S25FL256S at 0:0 is now current device

## Checking Image at 81000000 ...
   Legacy image found
   Image Name:   linux
   Image Type:   Blackfin Linux Standalone Program (gzip compressed)
   Data Size:    1519616 Bytes = 1.4 MiB
   Load Address: 01780000
   Entry Point:  01b00000
   Verifying Checksum ... OK
Programing start at: 0x01780000
write : 100%
done
TI8168_EVM#
 

IT Guy

n3wb
Joined
Jun 21, 2022
Messages
7
Reaction score
0
Location
Wisconsin
OK, I think I got it. So when I run that command it should pull the file from the TFTP server. I'm guessing I might need to run it for all the files except I probably shouldn't do the u-boot.bin.img file because that's the boot loader.

When I ran the printenv it had a lot of stuff but I'm guessing this is what I'm looking for:
dl=tftp 0x3000000 logo-x.cramfs.img; flwrite
dr=tftp 0x3000000 romfs-x.cramfs.img; flwrite
ds=tftp 0x3000000 slave-x.cramfs.img; flwrite
du=tftp 0x3000000 user-x.cramfs.img; flwrite
dw=tftp 0x3000000 web-x.cramfs.img; flwrite

The biggest file is the romfs-x.cramfs.img. The second biggest is the web-x.cramfs.img.

Does it matter which commands I run and what order?

Should I run:
run dr
run dw

Thanks,
IT guy
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,961
Reaction score
5,874
Location
Scotland
I'm guessing a bit here ...

I'd run the commands in the order that you found them in the update section of the install file.
It's prudent to skip updating the bootloader as if that goes wrong it's much harder to recover from.
Good luck!
 

IT Guy

n3wb
Joined
Jun 21, 2022
Messages
7
Reaction score
0
Location
Wisconsin
After a bit of work I got the TFTP working. I tried setting up with a cable connecting the DVR and PC but had trouble with that so I set up a router between them to connect. After that I was able to pull in the files with TFTP however the system still isn't booting. I tried on two systems and no luck on either. I'm not sure if there might be more wrong than just the firmware. On one that was working I unplugged it when it was booting up and after that it would no longer work or boot up. I thought the firmware got messed up but the flashing doesn't seem to fix it. Unless I'm doing something wrong.

Also, the Firmware doesn't have all the files that can be flashed.

The Firmware contains:
custom-x.cramfs.img
logo-x.cramfs.img
romfs-x.cramfs.img
sign.img
u-boot.bin.img
web-x.cramfs.img
Install.lua

The printenv command shows commands for:
da=tftp 0x3000000 u-boot.bin.img; flwrite
dc=tftp 0x3000000 custom-x.cramfs.img; flwrite
dl=tftp 0x3000000 logo-x.cramfs.img; flwrite
dr=tftp 0x3000000 romfs-x.cramfs.img; flwrite
ds=tftp 0x3000000 slave-x.cramfs.img; flwrite
du=tftp 0x3000000 user-x.cramfs.img; flwrite
dw=tftp 0x3000000 web-x.cramfs.img; flwrite

The Firmware doesn't include:
slave-x.cramfs.img
user-x.cramfs.img

The Firmware has the following which aren't listed in printenv:
sign.img

I don't know if this matters or maybe the DVR just doesn't need all of them.

Is it possible to run the install.lua command? Not sure if this is possible or not.

Thanks,
Dave
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
14,961
Reaction score
5,874
Location
Scotland
however the system still isn't booting.
Can you attach a transcript of the bootup?
Maybe someone can spot what's causing it not to succeed.

If there isn't much detail - you may have to use the commands
setenv dh_keyboard 0
saveenv
reset

to increase it. But I'm guessing a bit here ...
 

IT Guy

n3wb
Joined
Jun 21, 2022
Messages
7
Reaction score
0
Location
Wisconsin
One of the DVRs seems to change and do different things when booting up. I wonder if it has bad memory or something. The other one seems to do the same thing each boot up and looks almost identical to one of our working DVRs however the display never turns on and then it reboots. I'm going to change the command as posted above to get more detail and then I'll post the bootup.
 

IT Guy

n3wb
Joined
Jun 21, 2022
Messages
7
Reaction score
0
Location
Wisconsin
Here is the log. At the end you see a line of dots. At the last dot it reboots and starts from the beginning.

0cmp okSYSTEM go...............set ddr1 arg
DR 1.6 1GB
MP SPI-NOR Bootstrap v0.2
SPI020 Revision:0x10001
SPI flash ID code:ef 40 18
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn1475 (Sep 11 2014 - 19:52:33)svn:1475

I2C: ready
DRAM: 1008 MiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode


In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 396 HC: 336 P1:1188 P4:1008
C7:1008 C6: 792 DR:1584
J: 336 H1: 396 H2: 396
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode



16M
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x1FF
Hit any key to stop autoboot: 0
part_table->offet:0x00e80000,part_table->size:0x00040000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode


### CRAMFS loading '/bmp_logo.bmp' to 0x100000
can't find corresponding entry
### CRAMFS LOAD ERROR<0> for /bmp_logo.bmp!
load log failed
showlogo - showlogo - show the logo picture on screen.


Usage:
showlogo
Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Filename 'upgrade_info_7db780a713a4.txt'.
Load address: 0x3000000
Loading: T T T
Retry count exceeded; starting again
autoup - load update file from server

Usage:
autoup
part_table->offet:0x00060000,part_table->size:0x00c80000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode


SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x2000000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs load complete: 2023216 bytes loaded to 0x2000000
part_table->offet:0x00060000,part_table->size:0x00c80000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x18100000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs load complete: 2023216 bytes loaded to 0x18100000
part_table->offet:0x00060000,part_table->size:0x00c80000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0xf600000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs load complete: 1404783 bytes loaded to 0xf600000
part_table->offet:0x00060000,part_table->size:0x00c80000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0x37800000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs load complete: 1404783 bytes loaded to 0x37800000
part_table->offet:0x00060000,part_table->size:0x00c80000
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs loading '/slave/fc7500.bin' to 0x0
SF: Got idcodes
00000000: ef 40 18 00 .@..


SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
flash is 3byte mode
compressor use:lzma
### squashfs load complete: 634436 bytes loaded to 0x0
move ddr map to 0x00000000, offset 0x0, size 0x500000
move ddr map to 0x00000000, offset 0x2000000, size 0x500000
move ddr map to 0x18000000, offset 0x100000, size 0x500000
move ddr map to 0x08000000, offset 0x7600000, size 0x500000
move ddr map to 0x30000000, offset 0x7800000, size 0x500000
## Booting kernel from Legacy Image at 02000000 ...
Image Name: gm8210
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2023152 Bytes = 1.9 MiB
Load Address: 02000000
Entry Point: 02000040
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK
EP slave: initrd=0x37800000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=256M@0x10000000 gmmem=190M console=ttyS0,115200 mem=392M@0x20000000
EP master: initrd=0x0f600000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=240M@0x01000000 gmmem=100M console=ttyS0,115200 user_debug=31 mem=118M@0x38900000
move ddr map to 0x00000000, offset 0x1000000, size 0x400
move ddr map to 0x10000000, offset 0x0, size 0x400
move ddr map to 0x00000000, offset 0x0, size 0x0
slave: initrd=0x37800000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=256M@0x10000000 gmmem=190M console=ttyS0,115200 mem=392M@0x20000000
: mem=240M@0x01000000 gmmem=50M console=ttyS0,115200 user_debug=31 init=/squashfs_init root=/dev/mtdblock1 rootfstype=squashfs mem=118M@0x38900000 dh_keyboard=0 load_modules=1 matchinit_mode=530436

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
start to copy FC7500 core boot image at 0x18100000 and wait response...
wait FA6 core response ok
done, FA7 core now is booting.
Booting Linux on physical CPU 0
Linux version 3.3.0 SVN:5457 (jenkins@Centos-113) (gcc version 4.4.0 20100318 (experimental) (Buildroot 2012.02) ) #1 PREEMPT Mon Jul 6 20:34:29 CST 2015
CPU: FA7 [66057261] revision 1 (ARMv5TE), cr=00053177
CPU PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Grain-Media GM8210
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 89634
Kernel command line: mem=240M@0x01000000 gmmem=50M console=ttyS0,115200 user_debug=31 init=/squashfs_init root=/dev/mtdblock1 rootfstype=squashfs mem=118M@0x38900000 dh_keyboard=0 load_modules=1 matchinit_mode=530436
==>start:"=0 load_modules=1 matchinit_mode=530436" use_console:1
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 240MB 118MB = 358MB total
Memory: 357852k/357852k available, 8740k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0x96800000 - 0xff000000 (1672 MB)
lowmem : 0x80000000 - 0x96600000 ( 358 MB)
modules : 0x7f000000 - 0x80000000 ( 16 MB)
.text : 0x80008000 - 0x804b831c (4801 kB)
.init : 0x804b9000 - 0x804db000 ( 136 kB)
.data : 0x804dc000 - 0x80500560 ( 146 kB)
.bss : 0x80500584 - 0x80548618 ( 289 kB)
NR_IRQS:128
Timer use APB0 clock
gm_jiffies_init, system HZ: 100, pClk: 49500000
console [ttyS0] enabled
Calibrating delay loop... 1001.88 BogoMIPS (lpj=5009408)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x137cfc8 - 0x137d034
devtmpfs: initialized
FMEM: 12800 pages(0x3200000 bytes) from bank0 are reserved for Frammap.
FMEM: 26624 pages(0x6800000 bytes) from bank1 are reserved for Frammap.
FMEM: Logical memory ends up at 0x96600000, init_mm:0x80004000(0x1004000), PAGE_OFFSET:0x80000000(phys:0x1000000),
FMEM: FA726 Test and Debug Register: 0x100000
Fmem hooks external data-abort handler.
NET: Registered protocol family 16
PMU: Mapped at 0xfe000000
IC: GM8210, version: 0x11
PCIE PMU: Mapped at 0xfe00a000
IC: GM8312(1)
iotable: VA: 0xfe000000, PA: 0x99000000, Length: 4096
iotable: VA: 0xfe001000, PA: 0x98300000, Length: 4096
iotable: VA: 0xfe002000, PA: 0x98400000, Length: 4096
iotable: VA: 0xfe003000, PA: 0x98500000, Length: 4096
iotable: VA: 0xfe004000, PA: 0x98800000, Length: 4096
iotable: VA: 0xfe005000, PA: 0x98900000, Length: 4096
iotable: VA: 0xfe006000, PA: 0x82600000, Length: 4096
iotable: VA: 0xfe007000, PA: 0x99100000, Length: 4096
iotable: VA: 0xfe008000, PA: 0x98d00000, Length: 4096
iotable: VA: 0xfe009000, PA: 0x96000000, Length: 4096
iotable: VA: 0xfe00a000, PA: 0xc2700000, Length: 4096
iotable: VA: 0xfe00b000, PA: 0xc2800000, Length: 4096
8210 PCIE: 0x9680a000(0x99e00000), 8312 PCIE: 0x9680c000(0xc3700000)
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource fttmr010:1
NET: Registered protocol family 2
IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
TCP established hash table entries: 16384 (order: 5, 131072 bytes)
TCP bind hash table entries: 16384 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 16384 bind 16384)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Video Timer(timer3) Max 86000ms in 0xfdbcaa40 HZ.
ftdmac030 ftdmac030.0: DMA engine driver: irq 34, mapped at 9680e000
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 698
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
gpiochip_add: registered GPIOs 0 to 31 on device: ftgpio010.0
probe ftgpio010.0 OK, at 0x96878000
gpiochip_add: registered GPIOs 32 to 63 on device: ftgpio010.1
probe ftgpio010.1 OK, at 0x9687a000
Serial: 8250/16550 driver, 6 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xfe001000 (irq = 9) is a 16550A
serial8250: ttyS2 at I/O 0xfe003000 (irq = 20) is a 16550A
serial8250: ttyS3 at I/O 0xfe004000 (irq = 21) is a 16550A
serial8250: ttyS4 at I/O 0xfe005000 (irq = 22) is a 16550A
serial8250: ttyS5 at I/O 0xfe006000 (irq = 25) is a 16550A
brd: module loaded
loop: module loaded
FTSATA100_AHCI driver version 0.15
GM SATAPHY clock source : SATA0==PLL, SATA1==SATA0, SATA2==SATA1, SATA3==SATA2
GM SATAPHY Clock = 30 MHz
GM SATA0 config iSATA PHY setting
GM SATA0 PHY program i2c register offset 0x03, value=0x40
GM SATA1 config iSATA PHY setting
GM SATA1 PHY program i2c register offset 0x03, value=0x40
GM SATA2 config iSATA PHY setting
GM SATA2 PHY program i2c register offset 0x03, value=0x40
GM SATA3 config iSATA PHY setting
GM SATA3 PHY program i2c register offset 0x03, value=0x40
ahci ftsata100.0: forcing PORTS_IMPL to 0x1
ahci: SSS flag set, parallel bus scan disabled
ahci ftsata100.0: AHCI 0001.0100 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ftsata100.0: flags: ncq sntf stag pm led clo only pmp pio slum part ccc
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0xc1100000-0xc1100fff] port 0x100 irq 97
ahci ftsata100.1: forcing PORTS_IMPL to 0x1
ahci: SSS flag set, parallel bus scan disabled
ahci ftsata100.1: AHCI 0001.0100 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ftsata100.1: flags: ncq sntf stag pm led clo only pmp pio slum part ccc
scsi1 : ahci_platform
ata2: SATA max UDMA/133 mmio [mem 0xc1200000-0xc1200fff] port 0x100 irq 98
ahci ftsata100.2: forcing PORTS_IMPL to 0x1
ahci: SSS flag set, parallel bus scan disabled
ahci ftsata100.2: AHCI 0001.0100 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ftsata100.2: flags: ncq sntf stag pm led clo only pmp pio slum part ccc
scsi2 : ahci_platform
ata3: SATA max UDMA/133 mmio [mem 0xc1300000-0xc1300fff] port 0x100 irq 99
ahci ftsata100.3: forcing PORTS_IMPL to 0x1
ahci: SSS flag set, parallel bus scan disabled
ahci ftsata100.3: AHCI 0001.0100 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ftsata100.3: flags: ncq sntf stag pm led clo only pmp pio slum part ccc
scsi3 : ahci_platform
ata4: SATA max UDMA/133 mmio [mem 0xc1400000-0xc1400fff] port 0x100 irq 100
Not for NAND pin mux
SPI020 init
ftspi020 ftspi020.0: Faraday FTSPI020 Controller at 0x80300000(0x96898000) irq 92.
spi spi0.0: setup: bpw 8 mode 3
CLK = 336000000,50000000
CLK div field set 1
ERASE SECTOR 64K
SPI_FLASH spi0.0: w25q128bv (16384 Kbytes)
Creating 7 MTD partitions on "wb_spi_flash":
0x000000000000-0x000000060000 : "boot"
0x000000060000-0x000000ce0000 : "rootfs"
0x000000ce0000-0x000000e60000 : "web"
0x000000e60000-0x000000e80000 : "custom"
0x000000e80000-0x000000ec0000 : "logo"
0x000000ec0000-0x000001000000 : "config"
0x000000000000-0x000001000000 : "ALL"
Probe FTSPI020 SPI Controller at 0x80300000 (irq 92)
bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
nice use GMAC0
ftgmac100: Loading version 0.1 ...
ata2: SATA link down (SStatus 0 SControl 310)
ata3: SATA link down (SStatus 0 SControl 310)
ata4: SATA link down (SStatus 0 SControl 310)
ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
ata1.00: ATA-8: ST500DM002-1BD142, KC48, max UDMA/133
ata1.00: 976773168 sectors, multi 0: LBA48 NCQ (depth 31/32)
ata1.00: configured for UDMA/133
scsi 0:0:0:0: Direct-Access ATA ST500DM002-1BD14 KC48 PQ: 0 ANSI: 5
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 0:0:0:0: [sda] 976773168 512-byte logical blocks: (500 GB/465 GiB)
sd 0:0:0:0: [sda] 4096-byte physical blocks
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sda: sda1 sda2
sd 0:0:0:0: [sda] Attached SCSI disk
ftgmac100-0-mdio: probed
found Phy ID:0x00221622
ftgmac100-0 ftgmac100-0.0: eth0: 1 tx queue used (max: 2)
ftgmac100-0 ftgmac100-0.0: eth0: 1 rx queue used (max: 1)
ftgmac100-0 ftgmac100-0.0: eth0: irq 3, mapped at 9689a000
ftgmac100-0 ftgmac100-0.0: eth0: MAC address 00:1f:55:1b:17:e1
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
usbcore: registered new interface driver cdc_ncm
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
FOTG2XX Controller Initialization
Enter Device A
Drive Vbus because of ID pin shows Device A
fotg210 fotg210.0: FOTG2XX
fotg210 fotg210.0: new USB bus registered, assigned bus number 1
fotg210 fotg210.0: irq 101, io mem 0xc1500000
fotg210 fotg210.0: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
FOTG2XX Controller Initialization
Enter Device A
Drive Vbus because of ID pin shows Device A
fotg210 fotg210.1: FOTG2XX
fotg210 fotg210.1: new USB bus registered, assigned bus number 2
fotg210 fotg210.1: irq 102, io mem 0xc1600000
fotg210 fotg210.1: USB 2.0 started, EHCI 1.00
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
FOTG2XX Controller Initialization
Enter Device A
Drive Vbus because of ID pin shows Device A
fotg210 fotg210.2: FOTG2XX
fotg210 fotg210.2: new USB bus registered, assigned bus number 3
fotg210 fotg210.2: irq 103, io mem 0xc1700000
fotg210 fotg210.2: USB 2.0 started, EHCI 1.00
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mousedev: PS/2 mouse device common for all mice
i2c /dev entries driver
ftiic010 ftiic010.0: irq 18, mapped at 968aa000
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
NET: Registered protocol family 10
Mobile IPv6
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
devtmpfs: mounted
Freeing init memory: 136K
Failed to execute /squashfs_init. Attempting defaults...
[RCS]: /etc/init.d/S00devs
mknod: /dev/console: File exists
mkdir: can't create directory '/dev/input': File exists
mknod: /dev/input/mice: File exists
[RCS]: /etc/init.d/S01udev
mdev: applet not found
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S81toe
[RCS]: /etc/init.d/S99dh

7z ANSI-C Decoder 9.20 : Igor Pavlov : Public domain : 2010-11-18

Extracting adda.ko
Extracting adda160.ko
Extracting audio_drv.ko
Extracting avss.ko
Extracting cpu_comm_fa626.ko
Extracting cpu_comm_fa726.ko
Extracting decoder.ko
Extracting driverbox.ko
Extracting em.ko
Extracting fa726_lcd.ko
Extracting favc_dec.ko
Extracting favc_enc.ko
Extracting favc_rc.ko
Extracting fe_common.ko
Extracting flcd200-common.ko
Extracting flcd200-pip.ko
Extracting flcd200-pip1.ko
Extracting flcd200-pip2.ko
Extracting fmcp_drv.ko
Extracting fmjpeg_drv.ko
Extracting frammap.ko
Extracting fscaler300.ko
Extracting ft2dge.ko
Extracting ftdi220.ko
Extracting gs.ko
Extracting lc_ether.ko
Extracting log.ko
Extracting mje_rc.ko
Extracting ms.ko
Extracting osa.ko
Extracting osd_dispatch.ko
Extracting rt5370sta.ko
Extracting sli10121.ko
Extracting sw_osg.ko
Extracting think2d.ko
Extracting usbserial.ko
Extracting vcap0.ko
Extracting vcap300_common.ko
Extracting vcap300_dh9901.ko
Extracting vcap300_generic_m8.ko
Extracting vpd_master.ko
Extracting vpd_slave.ko

Everything is Ok
cp: can't stat '/var/lib/*.cfg': No such file or directory
Setting hostname ...
[ftgmac100_set_rfifo_size:2021]size_sel=0x3,rxthr_size=0xC0
Insmod Connect drivers!!

############## frammap.ko svn 25035 Jul 6 2015 22:04:25
Frammap: DDR0: memory base=0xc800000, memory size=0x3200000, align_size = 4K.
Frammap: DDR1: memory base=0x39000000, memory size=0x6800000, align_size = 4K.
Frammap: version 1.1.2, and the system has 2 DDR.
Frammap: fail to open /mnt/mtd/config_8210, /tmp/template_8210 is created.
----------------------------------------------------------------
ddr name: frammap0
base: 0xc800000
end: 0x
cpucomm svn 25035 Jul 6 2015 22:04:19
fa00000
ep_cnt = 2, non_ep_cnt = 1

memory allocatemem_alloc_init: physical memory begins at 0xc800000, ends at 0xf000000, 0x2800000 bytes.
d: 0x0 bytes
mcpucomm: PCI host, pool paddr:0xc800000, axi base:0x0, pci DDR base:0xf0000000, <guard:0x1000000>
emory free: 0x3200000 bytes
ma--- mbox paddr: 0xc800000, vaddr: 0x97000000 ---
x available slicWait FA626 core ready.e: 0x3200000 byt.es
memory allocate count: 0
clear address: 0xc800000
dirty pages: 0
clear pages: 12800
size alignment: 0x1000
----------------------------------------------------------------
ddr name: frammap1
base: 0x39000000
end: 0x3f800000
size: 0x6800000 bytes
memory allocated: 0x0 bytes
memory free: 0x6800000 bytes
max available slice: 0x6800000 bytes
memory allocate count: 0
clear address: 0x39000000
dirty pages: 0
clear pages: 26624
size alignment: 0x1000
..phy speed is 10, half duplex
[ftgmac100_set_rfifo_size:2021]size_sel=0x3,rxthr_size=0xC0
...........phy speed is 1000, full duplex
[ftgmac100_set_rfifo_size:2021]size_sel=0x3,rxthr_size=0xC0
.......
...........................................................................................................................................
 
Top